The attack works something like this: As Perry explained at DEFCON, a Gmail user might login to Gmail using the ostensibly secure URL https://mail.google.com. If subsequently surfing CNN.com, for example, via an open wireless connection, an attacker could inject a Gmail image URL and prompt the user's browser to transmit an unprotected Gmail 'GX' cookie in conjunction with the image fetch operation. The attacker could then 'sniff' the unprotected cookie and later use that file to access the victim's Gmail account.
Perry is planning to release a tool that makes HTTPS cookie hijacking easy. And he defends his plan to do so.
Revealing security flaws isn't popular among those that have to patch affected systems. The Massachusetts Bay Transit Authority, for example, recently obtained a temporary gag order -- lifted on Tuesday -- that prevented three MIT students from presenting information about security problems in the transit agency's fare card system.
But Perry maintains making security problems public is necessary.
My observations:
I'm glad that all the concerns are coming on surface a lot before the adoption phase. This way we won't have firms running after you while you hesitantly adopt their hot cool technology.
Source
Comments
Post a Comment